What is ISO 42001?

ISO/IEC 42001 is the first international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an Artificial Intelligence Management System (AIMS) within an organization. It is designed for entities of all sizes and types that develop, integrate, or use AI-based products or services.

Published in late 2023, the standard provides an excellent, globally recognized structure for meeting the requirements of the EU Artificial Intelligence Act (AI Act). Implementing an AIMS helps organizations ensure that their AI systems are deployed responsibly, safely, ethically, and in line with strategic business goals.

Key Characteristics of the Standard

Harmonized Structure: ISO 42001 follows the same High-Level Structure (HLS) as standards like ISO 27001 (information security) and ISO 9001 (quality), allowing for easy integration with existing management systems.
AI Impact Assessments: The standard mandates a process for evaluating the potential impacts of AI systems on individuals, groups, and society, including considerations for unintended misuse.
Lifecycle Governance: Requirements cover the entire lifecycle of AI systems, from initial requirements and dataset sourcing to model training, deployment, operational monitoring, and decommissioning.

Structure of the AI Management System (Clauses 4–10)

The standard’s core clauses define the AI governance framework:

Clause 4: Context of the Organization

The organization must determine the internal and external issues relevant to its purpose, understand the requirements of interested parties, define its role in the AI value chain (e.g., developer, integrator, or deployer), and document the scope of the AIMS.

Clause 5: Leadership

Senior management must demonstrate leadership and commitment. They must establish the AI policy (aligning it with business strategy), allocate necessary resources, and ensure roles, responsibilities, and authorities for AI governance are assigned and communicated.

Clause 6: Planning

The organization must address risks and opportunities related to AIMS and AI systems. This includes conducting detailed risk assessments and AI Impact Assessments (evaluating individual and societal impacts). Objectives for AI use must be set, and a Statement of Applicability (SoA) must be compiled.

Clause 7: Support

Operating an AIMS requires adequate resources, including computational power, tools, high-quality datasets, and expertise. The organization must ensure employee competence and AI literacy, manage communications, and control documented information.

Clause 8: Operation

The planned AI processes are put into action. This covers operational planning and control, implementing the lifecycle controls of Annex A, managing changes, performing regular risk assessments, and monitoring outsourced AI processes.

Clause 9: Performance Evaluation

The performance and behavior of AI systems must be monitored, evaluated, and measured. The standard requires conducting regular internal audits and senior management reviews of the AIMS.

Clause 10: Improvement

When a non-conformity or AI-related incident occurs (such as biased outcomes, unexpected model drift, or security breaches), the organization must take corrective actions, identify the root causes, and continuously improve the management system.

Annex A Controls

The mandatory Annex A of ISO 42001 contains 38 security and governance controls divided into 9 categories:

Policies Related to AI (A.2): Establishing an AI policy and aligning it with other organizational directives.
Internal Organization (A.3): Defining AI roles, responsibilities, and incident reporting channels.
Resources for AI Systems (A.4): Allocating and tracking data, tools, compute power, and human resources.
AI System Impact Assessment (A.5): Analyzing impacts on individuals, communities, and society.
AI System Lifecycle (A.6): Design, development, verification, validation, deployment, logging, and monitoring.
Data for AI Systems (A.7): Sourcing, quality, provenance, and preparation of datasets.
Information for Interested Parties (A.8): User documentation and transparent communication on AI use.
Use of AI Systems (A.9): Promoting the responsible, authorized, and intended use of AI models.
Third Parties and Customers (A.10): Managing supplier risks and addressing customer expectations.

How can Tekve help?

We help your organization deploy AI safely and responsibly by building an ISO 42001-compliant management system:

Role Identification & AIMS Scope: We determine your exact position in the AI value chain and define a realistic scope for your AIMS.
AI Impact Assessments & Risk Workflows: We build repeatable workflows to identify AI risks and assess societal/individual impacts.
AI Policies & Governance Documentation: We draft clear AI usage policies, secure development guidelines, and your official Statement of Applicability (SoA).
Gover Compliance Integration: We deploy our Gover platform as a centralized hub to manage your AI Act compliance, risk registers, and audits.